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DETAILED ACTION 

1 . Claims 1-24 are canceled, only claims 25-48 are presented to examiner for 
patentability consideration, refer to Pre-amendment filed Dec 27, 2004. 

Specification 

2. The abstract of the disclosure does not commence on a separate sheet in 
accordance with 37 CFR 1.52(b)(4). A new abstract of the disclosure is required and 
must be presented on a separate sheet, apart from any other text. 

Drawings 

3. The drawings filed on Dec 27, 2004 are objected because item 135 of Figure 3 
is not mentioned anywhere in Detailed Description section of Figure 3. Appropriate 
correction is required. 

Claim Rejections - 35 USC § 112 

The following is a quotation of the second Paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

In addition, 35 U.S.C. 112, sixth paragraph states that a claim limitation 
expressed in means-plus-function language as described in re Donaldson Co., 

16 F.3d 1189, 1195, 29 USPQ2d 1845, 1850 (Fed. Cir. 1994) (in banc). 

"shall be construed to cover the corresponding structure.., described in the specification and 
equivalents thereof." "If one employs means plus function language in a claim, one must set forth in 
the specification an adequate disclosure showing what is meant by that language. If an applicant fails 
to set forth an adequate disclosure, the applicant has in effect failed to particularly point out and 
distinctly claim the invention as required by the second paragraph of section 1 12" 
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4. Claims 25-43, and 47 are rejected under 35 U.S.C. 112, second Paragraph, as 
being indefinite for failing to particularly point out and distinctly claim the subject matter 
which applicant regards as the invention. 

Regarding claim 25, the phrase "reception of a privacy policy associated 
with said cookie" on lines 5-6 must have been clearly presented as a separate 
step (e.g. said user agent receiving a privacy policy associated with said cookie). 

Regarding claim 27, the phrase "said received privacy policy 1 on line 3 is 
not distinguished whether or not it is the same as "privacy policy" in claim 25 - 
line 5. Examiner suggests using "said privacy policy" instead. The phrase "cookie 
privacy policy" on line 4 is not clearly distinguished whether or not it is the same 
as "privacy policy in claim 25 - line 5 or "received privacy policy" in claim 27 - 
line 3. 

Regarding claim 31, the phrase "a stored cookie associated with said 
requested resource" on line 4 is not clarified whether or not it was the same as "a 
cookie" on line 3. 

Regarding claim 33, the phrase "reception of a cookie-policy receipt from 
said user agent " on lines 5-6 must have been clearly presented as a separate 
step (e.g. said content provider receiving a cookie-policy receipt from said user 
agent). 

Regarding claim 36, the phrase "said received privacy policf on line 2 is 
not distinguished whether or not it is the same as "privacy policy" in claim 33 - 
line 3. Examiner suggests using "said privacy policy" instead. The phrase "cookie 
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privacy policy 1 on line 3 is not clearly distinguished whether or not it is the same 
as "privacy policy 1 in claim 33 - line 3 or "received privacy policy" in claim 36 - 
line 2. 

Regarding claim 37, the phrase "reception of a privacy policy associated 
with said cookie" on lines 4-5 must have been clearly presented as a separate 
step (e.g. said user agent receiving a privacy policy associated with said cookie 
from said content provider). 

Regarding claim 39, the phrase "said received privacy policy*' on line 2 is 
not distinguished whether or not it is the same as "privacy policy associated with 
said cookie" in claim 37 - lines 4-5. Examiner suggests using "said privacy 
policy" instead. The phrase "cookie privacy policy 1 on line 3 is not clearly clarified 
whether or not it is the same as "privacy policy associated with said cookie" in 
claim 37 - lines 4-5 or "received privacy policy 1 in claim 39 - line 2. The term 
"said comparison" on line 4 is vague since there is no comparison (but only 
comparing means) mentioned previously in claim 39. 

Regarding claim 41, the phrase "said received privacy policy 1 on line 2 is 
not distinguished whether or not it is the same as "privacy policy associated with 
said cookie" in claim 37 - lines 4-5. Examiner suggests using "said privacy 
policy" instead. 

Regarding claim 43, the phrase "a stored cookie associated with said 
requested resource" on line 2 is not clarified whether or not it is the same as "a 
cookie" in claim 37 - line 2. 
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Regarding claim 47, the phrase "said received privacy policy on lines 2-3 
is not distinguished whether or not it is the same as "privacy policy associated 
with said cookie" in claim 44 - line 5. Examiner suggests using "said privacy 
policy" instead. The phrase "cookie privacy policy on line 3 is not clearly 
distinguished whether or not it is the same as "privacy policy associated with said 
cookie" in claim 44 - line 5 or "received privacy policy in claim 47 - lines 2-3. 
Claim Rejections - 35 USC § 101 

5. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

6. Claims 37-43; 44-47 are rejected under 35 U.S.C. 101 because the claimed 
invention is directed to non-statutory subject matter. 

Regarding claim 37, "a useragenf is being recited; however, it appears 
that the user agent would be reasonably interpreted by a person of ordinary skill 
in the art as software, per se. Applicant's specification provides no explicit and 
deliberate definition of the user agent, and it appears that such would reasonably 
be interpreted as representative of the software, which causes the transmission 
of data to occur. 

Claims 39-43 further disclose means for comparing, generating, 
presenting, authenticating, removing data of the user agent which clearly present 
that particularly claimed "useragenf as, indeed is, a software. 
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Regarding claim 44, "a content provider" is being recited, however, it 
appears that the content provider would be reasonably interpreted by a person of 
ordinary skill in the art as software, per se. Applicant's specification provides only 
limited definitions of the content provider [Page 25, Detailed Description, lines 
16-21], and it appears that such would reasonably be interpreted as 
representative of the software, which causes the transmission of data to occur. 

Claims 45-47 fail to resolve the deficiencies of claim 44, since the 
mechanisms of transmission of data clearly present that particularly claimed 
"content provide? as, indeed is, a software. 

Note that software does not fall within a statutory category since it is 
clearly not a series of steps or acts to constitute a process, not a mechanical 
device or combination of mechanical devices to constitute a machine, not a 
tangible physical article or object which is some form of matter to be a product 
and constitute a manufacture, and not a composition of two or more substances 
to constitute a composition of matter. 
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Claim Rejections - 35 USC § 102 

7. The following is a quotation of the appropriate Paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this Section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public 
use or on sale in this country, more than one year prior to the date of application for patent in the United 
States. 

8. Claims 25-29; 33-36; 37-43, as well as understood; 44-46; 47, as well as 
understood; and 48 are rejected under 35 U.S.C. 102(b) as being anticipated by Cranor 
et al. (Platform for Privacy Preferences Syntax Specification). 

Regarding claim 25, Cranor et al. clearly show and disclose a method of 
managing cookies in a data processing system comprising the steps of: 

a user agent requesting a resource associated with a cookie 
(proposal) from a content provider (home page of CoolCatalog) [Page 45, 
Appendix 4]. 

said user agent transmitting, in response to reception of a privacy 
policy associated with said cookie (receipt of a proposal) [Page 16, 
Section 3.3.4, Paragraph 1], a cookie-policy receipt (agreementID / 
fingerprint of agreement) [Page 5, Section 1 .3, Paragraph 4] to said 
content provider, said cookie-policy receipt specifying whether a user 
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associated with said user agent accepts that said content provider 

provides said cookie to user equipment associated with said user agent. 

Regarding claim 26, and as applied to claim 25 above, Cranor et al. 
further disclose a method wherein user agent transmitting said cookie-policy 
receipt (agreementlD/fingerprint of agreement) [Page 5, Section 1.3, Paragraph 
4] in a resource fetch message: OK in case of acceptance, [Page 14, Section 
3.3.1] or SRY in case of refusal [Page 15, Section 3.3.3, Paragraph 1]. 

Regarding claim 27, and as applied to claim 25 above, Cranor et al. 
further disclose: 

said user agent comparing said received privacy policy (proposal) 
with user preference to determine whether to enter into an agreement. An 
agreement applies to all data exchanged between the user agent and 
service within a specified realm [Page 5, Section 1 .3, Paragraph 2]. 

said user agent generating said cookie-policy, receipt 
(agreementlD/fingerprint of agreement) [Page 5, Section 1.3, Paragraph 4] 
based on said comparison [Page 5, Section 1.3, Paragraphs 3-4]. 
Regarding claim 28, and as applied to claim 27 above, Cranor et al. 
further disclose a method when received privacy policy does not match user 
preference [Page 5, Section 1 .3, Paragraph 4] comprising of: 

said user agent presenting said received privacy policy for said 
user on said user equipment (shown to a human user); and 
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said user agent generating said cookie-policy receipt (agreementID 

/ fingerprint of agreement) in response to a user-input signal. 

Regarding claim 29, and as applied to claim 25 above, Cranor et al. 
further disclose [Page 5, Section 1.3, Paragraph 4]: 

said user agent presenting said received privacy policy for said 

user on said user equipment (shown to a human user); and 

said user agent generating said cookie-policy receipt (agreementID 

/ fingerprint of agreement) in response to a user-input signal. 

Regarding claim 30, and as applied to claim 25 above, Cranor et al. 
further disclose the step of authenticating said cookie-policy receipt 
(agreementID / fingerprint of agreement) [Page 5, Section 1.3, Paragraph 4] with 
an authentication key (The MD5 algorithm is intended for digital signature 
applications, where a large file must be "compressed" in a secure manner before 
being encrypted with a private (secret) key under a public-key cryptosystem such 
as RSA or PGP) [Pages 41-44, Appendix 2] associated with said user agent. 

Regarding claim 33, Cranor et al. clearly show and disclose a method of 
providing cookies in a data processing system where in a user agent requests a 
resource associated with a cookie from a content provider, said method 
comprising the steps of: 

transmitting a privacy policy associated with said cookie to said 
user agent [Page 45, Appendix 4, Paragraph 4]; and 
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said content provider providing, in response to reception of a 
cookie-policy receipt (agreementlD/fingerprint of agreement) [Page 5, Section 

I . 3, Paragraph 4] from said user agent (user agent sending out requested data 
including agreementID it is operating under to server) [Page 16, Section 3.3.4, 
Paragraph 1], said cookie to user equipment associated with said user agent if 
said cookie-policy receipt specifies that a user associated with said user agent 
accepts that said content provider provides said cookie to said user equipment 
(once the user has accepted the agreement, the service will send the appropriate 
data elements, which are then saved transparently by the user agent) [Pages 10- 

I I , Section 2, Scenario 5]. 

Regarding claim 34, and as applied to claim 33 above, Cranor et al. 
further disclose a method wherein user agent transmitting said cookie-policy 
receipt (agreementlD/fingerprint of agreement) [Page 5, Section 1 .3, Paragraph 
4] in a resource fetch message: OK in case of acceptance, [Page 14, Section 
3.3.1] or SRY in case of refusal [Page 16, Section 3.3.3, Paragraph 1], 

Regarding claim 35, and as applied to claim 33 above, Cranor et al. 
further disclose a method wherein, said cookie-policy receipt 
(agreementlD/fingerprint of agreement) [Page 5, Section 1.3, Paragraph 4] 
specifies that a user associated with said user agent accepts that said content 
provider provides said cookie to said user equipment (once the user has 
accepted the agreement, the service will send the appropriate data elements, 
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which are then saved transparently by the user agent) [Pages 10-11, Section 2, 
Scenario 5]. 

Regarding claim 36, and as applied to claim 33 above, Cranor et al. 
further disclose a method wherein cookie policy receipt (agreementlD/fingerprint 
of agreement) [Page 5, Section 1.3, Paragraph 4] is generated based on a 
comparison between said received privacy policy and user preference [Page 5, 
Section 1.3, Paragraphs 3-4] that specifies an agreement. An agreement applies 
to all data exchanged between the user agent and service within a specified 
realm [Page 5, Section 1 .3, Paragraph 2]. 

Regarding claim 37, Cranor et al. clearly show and disclose a user agent 
provided in a data processing system for requesting a resource associated with a 
cookie (data) from a content provider; said user agent comprising: 

means for transmitting (communicating to the server using standard 
HTTP methods such as "GET" or "POST") [Page 13, Section 3.2, 
Paragraph 1], in response to reception of a privacy policy associated with 
said cookie (receipt of a proposal) [Page 16, Section 3.3.4, Paragraph 1], 
a cookie-policy receipt (agreementlD/fingerprint of agreement) [Page 5, 
Section 1 .3, Paragraph 4] to said content provider, said cookie-policy 
receipt specifying whether a user associated with said user agent accepts 
that said content provider provides said cookie to user equipment 
associated with said user agent [Page 5, Section 1.3, Paragraph 4]. 
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Regarding claim 38, and as applied to claim 37 above, Cranor et al. 
further disclose that transmitting means (standard HTTP methods such as "GET" 
or "POST") [Page 13, Section 3.2, Paragraph 1] from user agent to content 
provider includes said cookie-policy receipt (agreementlD/fingerprintof 
agreement) [Page 5, Section 1.3, Paragraph 4] in a resource fetch message: OK 
in case of acceptance, [Page 14, Section 3.3.1] or SRY in case of refusal [Page 
15, Section 3.3.3, Paragraph 1]. 

Regarding claim 39, and as applied to claim 37 above, Cranor et al. 
further disclose: 

means for comparing said received privacy policy (proposal/privacy 
practice) with user preference to determine whether to enter into an 
agreement. An agreement applies to all data exchanged between the user 
agent and service within a specified realm [Page 5, Section 1 .3, 
Paragraph 2]. 

means for generating, connected to said comparing means, said 
cookie-policy receipt (agreementlD/fingerprint of agreement) [Page 5, 
Section 1 .3, Paragraph 4] based on said comparison [Page 5, Section 1 .3, 
Paragraphs 3-4]. 

Regarding claim 40, and as applied to claim 39 above, Cranor et al. 
further disclose [Page 5, Section 1.3, Paragraph 4] a means for presenting said 
received privacy policy (proposal) for said user on said user equipment (shown to 
a human user); said generating means being adapted for generating said cookie- 
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policy receipt (agreementlD/fingerprint of agreement) in response to a user input 
signal. 

Regarding claim 41, and as applied to claim 37 above, Cranor et al. 
further disclose [Page 5, Section 1 .3, Paragraph 4]: 

means for presenting said received privacy policy for said user on 

said user equipment (shown to a human user); and 

means for generating said cookie-policy receipt (agreementID / 

fingerprint of agreement) in response to a user input signal 

Regarding claim 42, and as applied to claim 37 above, Cranor et al. 
further disclose a means to authenticate said cookie-policy receipt (agreementID 
/ fingerprint of agreement) [Page 5, Section 1 .3, Paragraph 4] with an 
authentication key (The MD5 algorithm is intended for digital signature 
applications, where a large file must be "compressed" in a secure manner before 
being encrypted with a private (secret) key under a public-key cryptosystem such 
as RSA or PGP) [Page 41 , Appendix 2] associated with said user agent. 

Regarding claim 44, Cranor et al. clearly show and disclose a content 
provider adapted for providing a requested resource associated with a cookie to 
a user agent in a data processing system, said content provider comprising: 

means for transmitting a privacy policy associated with said cookie 
to said user agent (content/proposal is sent to user agent in a header, HTML 
header, or as referenced by URI) [Page 9, Section 2, Scenario 1, Protocol 
Scenario]; and 
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means for providing, in response to reception of a cookie-policy 
receipt (agreementlD/fingerprint of agreement) [Page 5, Section 1.3, Paragraph 
4] from said user agent (user agent sending out requested data including 
agreementID it is operating under to server) [Page 16, Section 3.3.4, Paragraph 
1], said cookie to user equipment associated with said user agent if said cookie- 
policy receipt (agreementlD/fingerprint of agreement) [Page 5, Section 1.3, 
Paragraph 4] specifies that a use associated with said user agent accepts that 
said content provider provides said cookie to said user equipment (once the user 
has accepted the agreement, the service will send the appropriate data 
elements, which are then saved transparently by the user agent) [Pages 10-11, 
Section 2, Scenario 5]. 

Regarding claim 45, and as applied to claim 44 above, Cranor et al. 
further disclose that a content provider receiving said cookie-policy receipt 
(agreementlD/fingerprint of agreement) [Page 5, Section 1.3, Paragraph 4] in a 
resource fetch message: OK in. case of acceptance, [Page 14, Section 3.3.1] or 
SRY in case of refusal [Page 15, Section 3.3.3, Paragraph 1]. 

Regarding claim 46, and as applied to claim 44 above, Cranor et ai. 
further disclose means for providing said cookie-associated resource 
(content/proposal is sent to user agent in a header, HTML header, or as 
referenced by URI) [Page 9, Section 2, Scenario 1, Protocol Scenario] if said 
cookie-policy receipt specifies that said user accepts that said content provider 
provides said cookie to said user equipment (once the user has accepted the 
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agreement, the service will send the appropriate data elements, which are then 
saved transparently by the user agent) [Pages 10-11, Section 2, Scenario 5]. 

Regarding claim 47, and as applied to claim 44 above, Cranor et al. 
further disclose a content provider wherein cookie policy receipt (agreementID / 
fingerprint of agreement) [Page 5, Section 1.3, Paragraph 4] is generated based 
on a comparison between said received privacy policy and user preference 
[Page 5, Section 1.3, Paragraphs 3-4] that specifies an agreement. An 
agreement applies to all data exchanged between the user agent and service 
within a specified realm [Page 5, Section 1 .3, Paragraph 2]. 

Regarding claim 48, Cranor et al. clearly show and disclose a system for 
managing cookies in a data processing system comprising a user agent that 
requests a resource associated with a cookie (proposal) from a content provider 
[Page 45, Appendix 4], said system comprising: 

means for providing a privacy policy associated with said cookie 

(content/proposal is sent to user agent in a header, HTML header, or as 

referenced by URI) [Page 9, Section 2, Scenario 1, Protocol Scenario]; 
means for transmitting a cookie-policy receipt, said receipt 

transmitting means being responsive to said privacy policy (user agent 

communicates to the server using standard HTTP methods such as "GET" 

or "POST") [Page 13, Section 3.2, Paragraph 1]; and 

means for providing, in response to reception of a cookie-policy 

receipt from said user agent (user agent sending out requested data 
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including agreementID it is operating under to server) [Page 16, Section 
3.3.4, Paragraph 1], said cookie to user equipment associated with said 
user agent if said cookie-policy receipt specifies that a use associated with 
said user agent accepts that said content provider provides said cookie to 
said user equipment (once the user has accepted the agreement, the 
service will send the appropriate data elements, which are then saved 
transparently by the user agent) [Page 10-11, Section 2, Scenario 5]. 

Claim Rejections - 35 USC § 103 

9. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in Section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

10. Claim 31-32 and 43 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Cranor et al. in view of Mitchell et al. (Pat. No. US 6,959,420). 

Regarding claim 31 /Cranor et al. clearly show and disclose the claimed 
invention as set forth in the rejection of claim 25 above, in addition, Cranor et 
al. further disclose a cookie-policy receipt (agreementlD/fingerprint of agreement) 
[Page 5, Section 1 .3, Paragraph 4] specifying user not accepting a content 
provider provides cookie to user equipment. However, Cranor et al. do not 
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specifically disclose the step of removing previously stored cookie(s) associated 
with requested resource in user equipment. 

In the same field of endeavor, Mitchell et al. disclose a method to evaluate 
web site platform for privacy preferences policy wherein operation for web site to 
persist, retrieve (referred to as replay) or delete its cookie data in the set of 
cookies on the user's machine being done through user input via a prompt 
[Detailed Description, column 7-line 56 to column 8- line 28]. 

Therefore, it would have been obvious to a person of ordinary skill in the 
art at the time the invention was made that previously stored cookie(s) 
associated with a requested resource can be deleted through a user's input via a 
prompt as taught by Mitchell et al. in the system of Cranor et al. as described for 
preventing unauthorized content provider(s) to access and/or modify information / 
data from user's machine. 

Regarding claim 32, Cranor et al. clearly show and disclose the claimed 
invention as set forth in the rejection of claim 25 above, in addition, Cranor et 
al. further disclose a cookie-policy receipt (agreementlD/fingerprint of agreement) 
[Page 5, Section 1 .3, Paragraph 4] specifying user not accepting a content 
provider provides cookie to user equipment. However, Cranor et al. do not 
specifically disclose further transmission(s) of cookie request command to user 
equipment from unauthorized content provider(s) will be automatically ignored. 

In the same field of endeavor, Mitchell et al. disclose a method to evaluate 
web site platform for privacy preferences policy wherein user's response to the 
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prompt may be stored in association with a particular web site so that the user 
needs not again to be interrupted when this site is accessed [Detailed 
Description, column 12-lines 39-53]. 

Therefore, it would have been obvious to a person of ordinary skill in the 
art at the time the invention was made to acknowledge that when a request to set 
cookie on user's machine by a content provider is already rejected by user, 
followed requests by that particular provider will be ignored and/or automatically 
rejected by user agent as taught by Mitchell et al. in the system of Cranor et al. 
as described for preventing unauthorized content provider(s) to access and/or 
modify information / data from user's machine. 

Regarding claim 43, Cranor et al. clearly show and disclose the claimed 
invention as applied to claim 25 above, in addition, Cranor et al. further 
disclose a cookie-policy receipt (agreementlD/fingerprint of agreement) [Page 5, 
Section 1 .3, Paragraph 4] specifying user not accepting a content provider 
provides cookie to user equipment. However, Cranor et al. do not specifically 
disclose what would happen to previously stored cookie associated with 
requested resource in user equipment. 

In the same field of endeavor, Mitchell et al. disclose evaluation of web 
site platform with user's privacy preferences policy wherein there is a means for 
user agent to delete its cookie data in the set of cookies on the user's machine 
being done through user input via a prompt [Detailed Description, column 7-line 
56 to column 8-line 28]. 
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Therefore, it would have been obvious to a person of ordinary skill in the 
art at the time the invention was made to acknowledge that previously stored 
cookie can be deleted by the user agent through a user's input via a prompt as 
taught by Mitchell et al. in the system of Cranor et al. as described for preventing 
unauthorized content provider(s) to access and/or modify information / data from 
user's machine. 

Conclusion 

1 1 . The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

Gordon et al. (Patent No. US 7,137,009 B1) teaches a method for 
securing a cookie cache in a data processing system. 

Schran et al. (Pub. No. US 2002/0143770 A1) teaches a method for 
network administration and local administration of privacy protection criteria. 

Cranor et aL, "The Platform for Privacy Preferences 1.0 (P3P1.0) 
Specification" teaches the implementation of interoperable P3P applications. 
Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Son T. Hoang whose telephone number is (571) 270- 
1752. The examiner can normally be reached on Monday - Friday. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Dave Scherbel can be reached on (571) 272-4919. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for published 
applications may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications is available through Private PAIR only. For 
more information about the PAIR system, see http://pair-direct.uspto.gov. Should you 
have questions on access to the Private PAIR system, contact the Electronic Business 
Center (EBC) at 866-21 7-9197 (toll-free). If you would like assistance from a USPTO 
Customer Service Representative or access to the automated information system, call 
800-786-9199 (IN USA OR CANADA) or 571-272-1000. 




